Bug 180619 - iOS: Crash in Document::updateLayout() via Document::processViewport
Summary: iOS: Crash in Document::updateLayout() via Document::processViewport
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ryosuke Niwa
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-12-08 21:01 PST by Ryosuke Niwa
Modified: 2017-12-09 17:59 PST (History)
7 users (show)

See Also:


Attachments
Fixes the crash (4.82 KB, patch)
2017-12-08 21:47 PST, Ryosuke Niwa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2017-12-08 21:01:01 PST
When the viewport configuration is updated via meta element,
the modern media controls can end up updating the layout and cause a crash.

This is a real bug since updateLayout can execute arbitrary author scripts.
Comment 1 Ryosuke Niwa 2017-12-08 21:01:25 PST
<rdar://problem/35717575>
Comment 2 Ryosuke Niwa 2017-12-08 21:47:38 PST
Created attachment 328904 [details]
Fixes the crash
Comment 3 WebKit Commit Bot 2017-12-09 02:41:35 PST
Comment on attachment 328904 [details]
Fixes the crash

Clearing flags on attachment: 328904

Committed r225723: <https://trac.webkit.org/changeset/225723>
Comment 4 WebKit Commit Bot 2017-12-09 02:41:37 PST
All reviewed patches have been landed.  Closing bug.
Comment 5 Simon Fraser (smfr) 2017-12-09 10:08:05 PST
Can we stop calling these crashes please.
Comment 6 Ryosuke Niwa 2017-12-09 15:13:24 PST
(In reply to Simon Fraser (smfr) from comment #5)
> Can we stop calling these crashes please.

These are crashes. If we don't crash it here, it would later down the line as a security bug.
Comment 7 Darin Adler 2017-12-09 16:28:22 PST
Comment on attachment 328904 [details]
Fixes the crash

View in context: https://bugs.webkit.org/attachment.cgi?id=328904&action=review

> Source/WebCore/html/HTMLMetaElement.h:43
> +    void didFinishInsertingNode();

This is missing the "final" keyword. I guess this is a downside of us using "final" instead of "override", because I think we would have gotten a warning about this if we were using "override" on any other function in this class.